The compiled executable file is considered a Trojan threat

I converted a very simple bat file to EXE.

my C file looks like this:

#include <stdlib.h>
int main(int argc, char const *argv[]) {
    system("set PATH=%PATH%;%CD%\bin\ffmpeg");
    system("node server.js");
    return 0;
}

      

My .rc resources looks like this:

#include <windows.h>

A ICON MOVEABLE PURE LOADONCALL DISCARDABLE "favicon.ico"

      

I will compile it using:

windres -i resource.rc -o resource.o
tcc-o mediacenterjs.exe main.c resource.o 

      

This works great! But Avast and several other antivirus scanners see my EXE as a threat. The Trojan "I-Worm / Nuwar.L", to be precise.

What can I change or add to the code so that it doesn't end up as a virus.

+3


source to share


2 answers


One way to find out is to simply omit one of the lines to figure out which one is running (or if so). With this in mind, your code is not very secure as it relies on the computer path parameters to point to the correct executable node

.



Also, you can check if your path settings are actually saved after the first call system

.

+1


source


It's easier than you might think sometimes when we mess around with sockets and also antivirus might complain. The same can happen if you try to change something in the system, perhaps recognizing your application as a thread, not because it has a virus, but because of the behavioral analysis of the antivirus, since it has several detection methods, such as a signature. etc.



What you can do is debug your application to find where the problem is, maybe it is in a function system

that asks the system directly to change something that could be critical to the system (the antivirus does not know this or does) maybe you can handle this in a different way using the API.

+1


source







All Articles